Download
1 / 35
350 likes | 482 Views
Chapter 12. Operating System Security. Strategies. T he 2010 Australian Signals Directorate (ASD ) lists the “Top 35 Mitigation Strategies” Over 85 % of the targeted cyber intrusions investigated by ASD in 2009 could have been prevented
E N D
Chapter 12 Operating SystemSecurity
Strategies • The 2010 Australian Signals Directorate (ASD) lists the “Top 35 Mitigation Strategies” • Over 85% of the targeted cyber intrusions investigated by ASD in 2009 could have been prevented • The top four strategiesfor prevention are: • White-list approved applications • Patch third-party applications and operating system vulnerabilities • Restrict administrative privileges • Create a defense-in-depth system • These strategies largely align with those in the “20 Critical Controls” developed by DHS, NSA, the Department of Energy, SANS, and others in the United States
Operating System Security • Possible for a system to be compromised during the installation process before it can install the latest patches • Building and deploying a system should be a planned process designed to counter this threat • Process must: • Assess risks and plan the system deployment • Secure the underlying operating system and then the key applications • Ensure any critical content is secured • Ensure appropriate network protection mechanisms are used • Ensure appropriate processes are used to maintain security
Operating Systems Hardening • First critical step in securing a system is to secure the base operating system • Basic steps • Install and patch the operating system • Harden and configure the operating system to adequately address the indentified security needs of the system by: • Removing unnecessary services, applications, and protocols • Configuring users, groups, and permissions • Configuring resource controls • Install and configure additional security controls, such as anti-virus, host-based firewalls, and intrusion detection system (IDS) • Test the security of the basic operating system to ensure that the steps taken adequately address its security needs
Remove Unnecessary Services, Applications, Protocols • When performing the initial installation the supplied defaults should not be used • Default configuration is set to maximize ease of use and functionality rather than security • If additional packages are needed later they can be installed when they are required • If fewer software packages are available to run the risk is reduced • System planning process should identify what is actually required for a given system
Configure Users, Groups, and Authentication • System planning process should consider: • Categories of users on the system • Privileges they have • Types of information they can access • How and where they are defined and authenticated • Default accounts included as part of the system installation should be secured • Those that are not required should be either removed or disabled • Policies that apply to authentication credentials configured • Not all users with access to a system will have the same access to all data and resources on that system • Elevated privileges should be restricted to only those users that require them, and then only when they are needed to perform a task
Install Additional Security Controls Configure Resource Controls • Further security possible by installing and configuring additional security tools: • Anti-virus software • Host-based firewalls • IDS or IPS software • Application white-listing • Once the users and groups are defined, appropriate permissions can be set on data and resources • Many of the security hardening guides provide lists of recommended changes to the default access configuration
Test the System Security • Checklists are included in security hardening guides • There are programs specifically designed to: • Review a system to ensure that a system meets the basic security requirements • Scan for known vulnerabilities and poor configuration practices • Should be done following the initial hardening of the system • Repeated periodically as part of the security maintenance process • Final step in the process of initially securing the base operating system is security testing • Goal: • Ensure the previous security configuration steps are correctly implemented • Identify any possible vulnerabilities
Application Configuration • May include: • Creating and specifying appropriate data storage areas for application • Making appropriate changes to the application or service default configuration details • Some applications or services may include: • Default data • Scripts • User accounts • Of particular concern with remotely accessed services such as Web and file transfer services • Risk from this form of attack is reduced by ensuring that most of the files can only be read, but not written, by the server
Security Maintenance • Process of maintaining security is continuous • Security maintenance includes: • Monitoring and analyzing logging information • Performing regular backups • Recovering from security compromises • Regularly testing system security • Using appropriate software maintenance processes to patch and update all critical software, and to monitor and revise configuration as needed
Linux/Unix Security • Patch management • Keeping security patches up to date is a widely recognized and critical control for maintaining security • Application and service configuration • Most commonly implemented using separate text files for each application and service • Generally located either in the /etc directory or in the installation tree for a specific application • Individual user configurations that can override the system defaults are located in hidden “dot” files in each user’s home directory • Most important changes needed to improve system security are to disable services and applications that are not required
Linux/Unix Security • Users, groups, and permissions • Access is specified as granting read, write, and execute permissions to each of owner, group, and others for each resource • Guides recommend changing the access permissions for critical directories and files • Local exploit • Software vulnerability that can be exploited by an attacker to gain elevated privileges • Remote exploit • Software vulnerability in a network server that could be triggered by a remote attacker
Linux/Unix Security • chrootjail • Restricts the server’s view of the file system to just a specified portion • Uses chroot system call to confine a process by mapping the root of the filesystem to some other directory • File directories outside the chroot jail aren’t visible or reachable • Main disadvantage is added complexity
Virtualization • Atechnology that provides an abstraction of the resources used by some software which runs in a simulated environment called a virtual machine (VM) • Benefits include better efficiency in the use of the physical system resources • Provides support for multiple distinct operating systems and associated applications on one physical system • Raises additional security concerns
Virtualization Security Issues • Security concerns include: • Guest OS isolation • Ensuring that programs executing within a guest OS may only access and use the resources allocated to it • Guest OS monitoring by the hypervisor • Which has privileged access to the programs and data in each guest OS • Virtualized environment security • Particularly image and snapshot management which attackers may attempt to view or modify
Hypervisor Security • Should be • Secured using a process similar to securing an operating system • Installed in an isolated environment • Configured so that it is updated automatically • Monitored for any signs of compromise • Accessed only by authorized administration • May support both local and remote administration so must be configured appropriately • Remote administration access should be considered and secured in the design of any network firewall and IDS capability in use • Ideally administration traffic should use a separate network with very limited access provided from outside the organization
Summary • Introduction to operating system security • System security planning • Operating systems hardening • Operating system installation: initial setup and patching • Remove unnecessary services, applications and protocols • Configure users, groups, and authentications • Configure resource controls • Install additional security controls • Test the system security • Application security • Application configuration • Encryption technology • Security maintenance • Logging • Data backup and archive • Linux/Unix security • Patch management • Application and service configuration • Users, groups, and permissions • Remote access controls • Logging and log rotation • Application security using a chroot jail • Security testing • Windows security • Patch management • Users administration and access controls • Application and service configuration • Other security controls • Security testing • Virtualization security • Virtualization security
